Author Topic: Avast is blocking a normal site  (Read 18731 times)

0 Members and 1 Guest are viewing this topic.

kaboose

  • Guest
Avast is blocking a normal site
« on: June 21, 2012, 03:14:23 AM »
Hey everyone since last couple of days avast has been blocking a site for me. How can i change the settings so it doesnt block this website. Heres the screen shot:

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37507
  • Not a avast user
Re: Avast is blocking a normal site
« Reply #1 on: June 21, 2012, 05:41:58 AM »
Quote
Avast is blocking a normal site
what is a normal site?........and a not normal site?



Zulu URL Risk Analyzer
http://zulu.zscaler.com/submission/show/a09e39085ffc8799c20db2ab8309af80-1340249949

URLVoid
http://urlvoid.com/scan/bollywoodtorrents.me/
« Last Edit: June 21, 2012, 05:44:14 AM by Pondus »

Offline Milos

  • Avast team
  • Super Poster
  • *
  • Posts: 2293
Re: Avast is blocking a normal site
« Reply #2 on: June 21, 2012, 07:54:22 AM »
Hello,
it's similar to other topics, which comes up in last days saying that avast! detects "HTML:Script-inf" there. In this site here is <script> tag which leads to "phpinclude-bin.com".

I other topics there are this URLs:

phpinclude-bin.com
scriptincludes.com
safesurf-check.com
jscriptss.com

this sites are blocked correctly.

Milos
« Last Edit: June 21, 2012, 08:03:59 AM by Milos »

kaboose

  • Guest
Re: Avast is blocking a normal site
« Reply #3 on: June 21, 2012, 09:56:31 AM »
but i know this site is not harmful. So how can i stop avast from blocking it?

Offline Milos

  • Avast team
  • Super Poster
  • *
  • Posts: 2293
Re: Avast is blocking a normal site
« Reply #4 on: June 21, 2012, 10:10:13 AM »
but i know this site is not harmful. So how can i stop avast from blocking it?

Hello,
inform admin of that web to remove infection.

Milos

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
Re: Avast is blocking a normal site
« Reply #5 on: June 21, 2012, 10:18:09 AM »
Hi Kaboose,

The problem is not with avast blocking this site. The detection is genuine as avast's Milos stated here.
The problem is with the webmaster of the site and/or the hoster of that domain for not cleansing the site from malcode that avast detects.
Furthermore the vbulletin software on that site was not updated leaving it open to vulnerablities that could lead to malcode injections.
So you should not try to circumvent an appropriate avast blocking of a site,  but rather inform the webmaster of that site he has serious security issues.
Funny is that we get a lot of reactions like this. Avast detects malcode on a  site and then users ask: "What can avast do about this?". Not a lot.
If something of a malware alert appears a lot of users try "to click this away  as soon as possible, because it irritates them, putting themselves out to real danger of getting infected". I do not mean this personally but as a general observation of the common average user reaction.
Users just demand instant solutions and are easily irritated these days....

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

kaboose

  • Guest
Re: Avast is blocking a normal site
« Reply #6 on: June 22, 2012, 08:01:21 AM »
I guess i havent been cleared so far. My purpose of this thread is to know is there any setting i can change in Avast so it DOESNT block this website? Because i knw for a fact by visiting that website its not doing any harm to my computer. PERIOD. thanks

AdrianH

  • Guest
Re: Avast is blocking a normal site
« Reply #7 on: June 22, 2012, 08:34:41 AM »
Sure there are ways to get around this but no one here is likely to assist doing this when the site is clearly  infected. Besides avast! there are several other antivirus/malware companies reporting it. Malwarebytes has this site on their blocklist too so while you "think" you know you will be safe others have proven there is an issue with that site , the warnings and blocking are in place for a very good reason.

redgoals

  • Guest
Re: Avast is blocking a normal site
« Reply #8 on: June 23, 2012, 02:19:18 PM »
Hi,

We have removed the malicious script from the code, does anyone know how long it takes for the blacklisting to be removed after submitting a removal request?

regards
rg

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37507
  • Not a avast user
Re: Avast is blocking a normal site
« Reply #9 on: June 23, 2012, 02:27:40 PM »
since it detects the script on the web site..... (not a URL / black list block) ....then detection should be gone as soon as the script is removed
« Last Edit: June 23, 2012, 02:30:25 PM by Pondus »

Offline !Donovan

  • Web Analyst
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2219
    • The WAR Against Malware
Familiarize Yourself! | Educate Yourself! | Beautify Yourself! | Scan Yourself!
"People who say it cannot be done should not interrupt those who are doing it."

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
Re: Avast is blocking a normal site
« Reply #11 on: June 23, 2012, 02:45:29 PM »
That might be true, Pondus, still that site throws up an IDS alert as malvertising site: ET RBN Known Malvertiser IP (5) (Suricata/Emerging Threats)
-> http://urlquery.net/report.php?id=74205
Check the JS writes [18] there is a GET request for some GET /contact/bct?pid=5CF40FD6-etc. etc.
also see: http://www.mywot.com/en/scorecard/p.brilig.com
p.brilig dot com is listed in OpenDNS's Block Tool http://forums.opendns.com
creators view this as legit ads, others as malvertising adware/spyware (can make fx freeze)

polonus
« Last Edit: June 23, 2012, 03:12:54 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

redgoals

  • Guest
Re: Avast is blocking a normal site
« Reply #12 on: June 23, 2012, 03:33:35 PM »
That might be true, Pondus, still that site throws up an IDS alert as malvertising site: ET RBN Known Malvertiser IP (5) (Suricata/Emerging Threats)
-> http://urlquery.net/report.php?id=74205
Check the JS writes [18] there is a GET request for some GET /contact/bct?pid=5CF40FD6-etc. etc.
also see: http://www.mywot.com/en/scorecard/p.brilig.com
p.brilig dot com is listed in OpenDNS's Block Tool http://forums.opendns.com
creators view this as legit ads, others as malvertising adware/spyware (can make fx freeze)

polonus

thats the wrong url,  you missed the s on the end... http://urlquery.net/report.php?id=72608 (how does this look ?)

regards
rg

AdrianH

  • Guest
Re: Avast is blocking a normal site
« Reply #13 on: June 23, 2012, 03:51:28 PM »
Mawarebytes Pro is still blocking that site.

Offline !Donovan

  • Web Analyst
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2219
    • The WAR Against Malware
Re: Avast is blocking a normal site
« Reply #14 on: June 23, 2012, 03:52:17 PM »
That link is outdated (21st June).

The new link has the phpinclude-bin link removed. See: http://urlquery.net/report.php?id=74230
Familiarize Yourself! | Educate Yourself! | Beautify Yourself! | Scan Yourself!
"People who say it cannot be done should not interrupt those who are doing it."